CVE-2026-80920

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

io_uring: defer eventfd signaling when queued from a wakeup handler

io_req_local_work_add() signals the CQ ring eventfd inline when it is the

one to push the first entry onto ->work_list. For DEFER_TASKRUN rings that

add is frequently done from a waitqueue wakeup handler, where an

arbitrary waitqueue lock is held.

eventfd_signal_mask() only refuses to recurse when current->in_eventfd

is set, but that bit is set by eventfd_signal_mask() itself. If the wake

chain starts somewhere else, signal goes out inline and can feed back

into epoll.

Add IOU_F_TWQ_IN_WAKE, set it on the task_work add done from the three

waitqueue callbacks, and use it to force io_eventfd_signal() down the

existing call_rcu_hurry() deferral instead of signaling inline.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References